KYC and EDD Policies and Procedures

Purpose and principles

This document sets out the rules and procedures for the identification, profiling and verification of users (Know Your Customer — KYC) and the criteria for applying enhanced due diligence (EDD) on the XIP platform.

It forms part of and elaborates on the AML/CFT Policy and Internal Procedures, and observes the limits on the processing of personal data established in the Data Protection and Privacy Policy.

The following principles govern its application:

Scope of application

These rules apply to natural persons resident in Brazil, aged 18 or over and with full legal capacity. The platform does not currently accept verification records for legal entities: the record is created exclusively under the natural-person classification, and there is no flow for the representation of an entity.

The user must also hold a CPF in good standing (CPF, Brazil's individual taxpayer registry number) and have their own crypto-asset wallet on the platform, the address of which is linked to the verification record at the time of verification.

When verification is required

Creating an XIP account — with an e-mail address, username and password — allows the user to use the non-custodial wallet, the keys to which are generated on the user's own device. This step does not involve financial intermediation and does not require identity verification.

Verification is required at the point when the user intends to carry out the first operation in Brazilian reais, whether inbound (on-ramp) or outbound (off-ramp). The application displays the notice of the requirement and directs the user to the verification flow from three entry points: the account settings, the deposit screen and the withdrawal screen.

Data and documents required

Identification data

Documents

The user chooses between the RG and the CNH. Changing the option after the images have been submitted discards the document images already attached, in order to prevent an inconsistent combination of different documents — the facial image is preserved.

Technical requirements for the images

• the images are captured by the device camera or selected from the gallery;
• they are converted to JPEG and compressed on the device itself before transmission, with a size budget distributed across the images in the set and a minimum floor per image, so as to preserve legibility;
• compression takes place on the device, which reduces the volume transmitted and the exposure time of the data in transit.

Validations applied at collection

Before any submission, the application validates the data entered. A step does not advance while any data item is invalid. The same rules are reapplied on the server, so that validation does not depend on the integrity of the client.

Verification flow

The flow has four collection steps, followed by submission and analysis. Backward navigation between steps is unrestricted, allowing correction before submission.

Until the analysis is concluded, the application periodically polls the status of the verification record. The query to the contracted provider occurs only where the status is non-terminal — pending, submitted or under review — thereby avoiding unnecessary requests after a final decision. Momentary communication failures do not alter the recorded state: the known status is preserved and the query is repeated.

Record states

The verification record has two independent state dimensions: the verification state, which reflects the progress of the document analysis, and the record state, which reflects its eligibility to transact. Both must be favourable.

Verification state

Record state

Transaction eligibility

On each quote or operation request, the server checks the user's verification record and requires the conjunction of two conditions:

The criterion is identical for inbound and outbound operations, with no differentiation by amount, by account age or by commercial decision. The absence of a verification record is treated as a failure of the condition, in the same way as a rejected or suspended record.

The check occurs in the server's service layer, before any external effect. There is no path through the application, the administrative interface or the API that allows transacting without satisfying these conditions. The technical evidence is set out in Evidence of KYC Records.

Immutable fields and updatable fields

Once the verification has been approved, the record is sealed: the server rejects attempts to alter identification data and to re-send documents, responding with an error specific to an already approved record. Subsequent changes occur only through formal support procedure, with a record kept and, where required, a new verification.

Updating data before approval does not automatically restart the analysis: to return to the analysis queue, the user resubmits the documents.

Rejection and resubmission

Where verification is rejected, the user is informed of the reason recorded by the contracted provider, displayed in legible form in the application, so that the user can correct the cause and resubmit.

Rules on resubmission:

• it is permitted in any non-approved state — pending, submitted, under review or rejected;
• the user returns to the beginning of the flow and may revise data and replace images;
• the new submission returns the record to the submitted state, and the analysis is performed again;
• the record held with the contracted provider is not recreated: the resubmission updates the existing record, preserving the history and the link to the account;
• the history of previous rejections is preserved as an element of risk assessment — repeated rejections constitute a risk factor and may give rise to enhanced due diligence.

Enhanced due diligence (EDD)

Enhanced due diligence is the set of additional measures applied where the risk identified exceeds the standard level. Its application is mandatory in the circumstances below, not discretionary.

Triggers

Applicable measures

Where a trigger is met, the following measures apply, according to the nature of the risk — cumulatively, where necessary:

1. Supplementary documentation: proof of address, proof of income or of financial capacity and documents evidencing the source of funds involved.
2. Declaration of the source and intended use of the funds, identifying the economic activity and the purpose of the intended operations.
3. Declaration of acting in one's own name, in which the user states that they transact in their own name and for their own account.
4. Searches in public sources concerning the user, including adverse media and relevant court proceedings.
5. Approval at a higher level: eligibility depends on an express and reasoned decision of the Compliance and AML/CFT Officer, recorded in writing. No commercial function may substitute for that approval.
6. Restriction of limits on the amount and frequency of operations, for as long as the elevated risk persists.
7. Shortened periodic review: reassessment of the verification record at intervals shorter than the ordinary ones.
8. Reinforced monitoring: notification to the contracted provider of the elevated risk classification, so that monitoring of the operations is intensified.
9. Rejection or termination, where the risk cannot be adequately mitigated or where the user does not comply with the requests.

Every enhanced due diligence measure is recorded with the date, reason, documents analyzed, decision and person responsible, forming part of the user's file for audit purposes.

Re-profiling and record updating

The user is responsible for keeping their record data up to date and must report material changes through the support channels.

Recording, auditability and data minimization

For each verification record, the following are recorded and retained:

• the holder's full name and CPF;
• the linked wallet address;
• the identifier of the record held with the contracted provider, which permits correlation without replication of content;
• the verification state and the record state, with the history of transitions;
• the reason for rejection, where there is one;
• the date of the analysis;
• a full copy of the contracted provider's response, preserved in structured format as an independent audit trail.

Structural database constraints guarantee a single record per user and per provider and the uniqueness of the external identifier, which prevents duplicate records and any dissociation between record and account. The link to the account is mandatory.

Conversely, and by design decision, the following are not stored by XIP: the identification document images, the facial image, the type of document presented and the telephone number. Application logs that mention sensitive identifiers record them in masked form.

The retention periods are set out in the Data Protection and Privacy Policy and observe the minimum of 5 years required by anti-money laundering legislation.

Final rejection and termination

The following are grounds for final refusal of eligibility and for termination of the relationship:

• a confirmed match on a sanctions list;
• presentation of a false or altered document, or of a document belonging to a third party;
• a finding that the holder is a minor or lacks legal capacity;
• unjustified refusal to present documentation required under enhanced due diligence;
• confirmation of action on behalf of an undeclared third party;
• an order of a competent authority;
• non-mitigable risk, in accordance with a reasoned decision of the Compliance and AML/CFT Officer.

Termination does not eliminate the records, which are retained for the statutory periods, and does not affect the user's access to the crypto-assets held in their own wallet, which remain under their exclusive control by virtue of the non-custodial model.

Monitoring indicators

The following are compiled and reported to management at least every six months:

• the volume of verifications initiated, concluded, approved and rejected;
• the approval and rejection rates, with the distribution of the reasons for rejection;
• the average time between submission of the documents and the decision;
• the abandonment rate by step of the flow, in order to identify undue friction;
• the volume of resubmissions and of repeated rejections per user;
• the number of cases subjected to enhanced due diligence, by trigger, and the respective outcome;
• the number of records suspended and blocked, with the reason;
• the number of requests from authorities fulfilled and the time taken to respond.

Effective date and review

This document takes effect on the date stated in the header, is reviewed at least annually and, on an extraordinary basis, whenever there is a legal or regulatory change, a change of flow or of contracted provider, or the identification of a deficiency in an effectiveness assessment.

Version history